This disclosure relates to a safety control system for switching on and safely switching off at least one actuator.
Such a safety control system is known, for example, from the operating instructions “PSSuniversal, Programmable control systems PSS®, System Description,” article number 21256-DE-04, by the applicant.
Accordingly, in the context of the present disclosure, a safety control system is a preferably modular device having at least one input module and one output module. The input modules receive input signals from connected safety transmitters, for example, light barriers, light curtains, emergency stop pushbuttons, or protective door switches, and generate output signals from them via logical linking. In response to the output signals, the output modules drive actuators, which effectuate targeted actions or a response in the surroundings as a function of the input signals, for example, in order to switch off a machine such as a press or a welding robot, which poses a risk during operation, or to bring it into a safe condition.
Safety transmitters are differentiated into two types of safety transmitters. The first type of safety transmitters are passive safety transmitters, which generate no input signal themselves. Passive safety transmitters receive a test signal from an external source, usually from the safety control system, in the form of a static potential or a clock signal, and send it unchanged to an evaluating safety control system if the safety transmitter indicates a safe condition. If the state changes, for example, because the safety transmitter has been actuated, the safety transmitter interrupts the signal flow. The safety control system detects the change in state based on the absent signal.
One passive safety transmitter, for example, is a two-channel emergency stop switch having two normally closed contacts. In this context, normally closed contact means that the signal path to be switched is closed in the normal, non-actuated state. Therefore, in the non-actuated state, test signals which are routed to the safety transmitter on the input side are present unchanged at its outputs. The outgoing signals from the safety transmitter are in turn the input signals of the evaluating safety control system, so that an input signal is always applied to the safety control system during normal operation. As soon as the emergency stop switch is actuated, the signal flow is interrupted and the input signals are absent. Thereupon, the safety control system may switch off the machine to be monitored or bring it into a safe condition.
Furthermore, antivalent two-channel safety transmitters are known in the form of passive safety transmitters, which have one normally closed contact and one normally open contact which are positively linked, instead of two normally closed contacts. A normally open contact is the opposite of a normally closed contact; i.e., in the normally open contact, the signal path is normally open and is closed only when the switch is actuated. In an antivalent two-channel safety transmitter, a signal path is thus closed and another signal path is open in every state. In this case, the safety control system detects the state change in that a signal is present at an input at which no signal was previously present, whereas the signal is absent at a second input.
Active safety transmitters are known as another type of safety transmitters. They automatically generate an input signal which represents their respective state. Active safety transmitters, which are also referred to as output signal switching devices (OSSDs), and whose input signals for the safety control system are referred to as OSSD signals, are generally more complex safety transmitters such as light barriers and light curtains. OSSDs generally have their own electronic unit for evaluating the monitoring components and for generating the OSSD signal. As with passive safety transmitters, the associated safety control system detects the state change of an active safety transmitter in that the input signals are absent or change.
In both passive and active safety transmitters, the input signal which represents the state of the safety transmitter is generally a static potential which is preferably superimposed with test pulses, in order to be able to detect faults when connecting the safety transmitters, as well as short circuits and cross-short circuits on the signal lines. In addition, switch-off tests may also be carried out by means of the test pulses. The clock signals are generally generated by the safety control system, and are superimposed directly on the input signals in the case of passive safety transmitters, or indirectly in the case of active safety transmitters. By reading back the clock signals at the inputs, the safety control system may close for any possible faults.
In the case of passive safety transmitters, the superimposition with a dynamic clock signal generally takes place directly, in that the test signals which are sent to the safety transmitters already have the clock. In the case of active safety transmitters, which generate the input signal automatically, the dynamic clock signals may be either self-generated according to a specified scheme or triggered externally. The latter takes place via a separate test input at the safety transmitter, at which a clock may be fed in, on the basis of which the safety transmitter may impress test impulses on the input signal.
In order to connect the different types of safety transmitters to one safety control system, it is conceivable to provide a specific input module for each type of safety transmitter. Alternatively, input modules are possible which have filters at the inputs which allow connecting different types of safety transmitters to one input module. The filters suppress test pulses, so that static signals are available for the logical evaluation. However, this necessarily results in the evaluation being delayed overall; thus, the response time of the safety control system increases.
Furthermore, input modules are known which have different inputs and, depending on the configuration of these inputs, close according to the type of the connected safety transmitter. Such a safety switching device is described, for example, in DE 197 07 241 C2. However, these devices have the disadvantage that the input modules also have inputs, so that wiring is more complex and error-prone. In addition, it is possible to cover only a limited number of different safety transmitter types by means of these input modules.